They should treat logins from a different part of the world differently. One should be able to register their devices all at once. Allow the attacker to login but not to a real account and then use the opportunity to trace the offender.